Details of VAR-201205-0128

ID

VAR-201205-0128

CVE

CVE-2012-2612

TITLE

SAP NetWeaver of DiagTraceHex Service disruption in functions ( Daemon crash ) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2012-002406

DESCRIPTION

The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. SAP NetWeaver is prone to a remote code-execution vulnerability and multiple denial-of-service vulnerabilities. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or crash the application

Trust: 1.98

sources: NVD: CVE-2012-2612 // JVNDB: JVNDB-2012-002406 // BID: 53424 // VULMON: CVE-2012-2612

AFFECTED PRODUCTS

vendor:	sap	model:	netweaver	scope:	eq	version:	7.0	Trust: 1.6
vendor:	sap	model:	netweaver	scope:	eq	version:	7.0 ehp1 (disp+work.exe 7010.29.15.58313)	Trust: 0.8
vendor:	sap	model:	netweaver	scope:	eq	version:	7.0 ehp2 (disp+work.exe 7200.70.18.23869)	Trust: 0.8
vendor:	sap	model:	netweaver ehp2	scope:	eq	version:	7.0	Trust: 0.3
vendor:	sap	model:	netweaver ehp1	scope:	eq	version:	7.0	Trust: 0.3

sources: BID: 53424 // JVNDB: JVNDB-2012-002406 // CNNVD: CNNVD-201205-234 // NVD: CVE-2012-2612

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-2612
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-2612
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201205-234
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2012-2612
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-2612
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

sources: VULMON: CVE-2012-2612 // JVNDB: JVNDB-2012-002406 // CNNVD: CNNVD-201205-234 // NVD: CVE-2012-2612

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2012-002406 // NVD: CVE-2012-2612

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201205-234

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201205-234

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-002406

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2012-2612

PATCH

title:	Acknowledgments to Security Researchers	url:	http://scn.sap.com/docs/DOC-8218	Trust: 0.8
title:	martingalloar	url:	https://github.com/martingalloar/martingalloar	Trust: 0.1
title:	publications	url:	https://github.com/martingalloar/publications	Trust: 0.1

sources: VULMON: CVE-2012-2612 // JVNDB: JVNDB-2012-002406

EXTERNAL IDS

db:	NVD	id:	CVE-2012-2612	Trust: 2.8
db:	SECTRACK	id:	1027052	Trust: 1.1
db:	JVNDB	id:	JVNDB-2012-002406	Trust: 0.8
db:	CNNVD	id:	CNNVD-201205-234	Trust: 0.6
db:	BID	id:	53424	Trust: 0.3
db:	EXPLOIT-DB	id:	20705	Trust: 0.1
db:	VULMON	id:	CVE-2012-2612	Trust: 0.1

sources: VULMON: CVE-2012-2612 // BID: 53424 // JVNDB: JVNDB-2012-002406 // CNNVD: CNNVD-201205-234 // NVD: CVE-2012-2612

REFERENCES

url:	http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities	Trust: 2.0
url:	https://service.sap.com/sap/support/notes/1687910	Trust: 1.7
url:	http://scn.sap.com/docs/doc-8218	Trust: 1.7
url:	http://www.securitytracker.com/id?1027052	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/75452	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2612	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2612	Trust: 0.8
url:	http://www.sap.com/platform/netweaver/index.epx	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=34857	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/martingalloar/martingalloar	Trust: 0.1
url:	https://www.exploit-db.com/exploits/20705/	Trust: 0.1

sources: VULMON: CVE-2012-2612 // BID: 53424 // JVNDB: JVNDB-2012-002406 // CNNVD: CNNVD-201205-234 // NVD: CVE-2012-2612

CREDITS

Core Security - Corelabs

Trust: 0.3

sources: BID: 53424

SOURCES

db:	VULMON	id:	CVE-2012-2612
db:	BID	id:	53424
db:	JVNDB	id:	JVNDB-2012-002406
db:	CNNVD	id:	CNNVD-201205-234
db:	NVD	id:	CVE-2012-2612

LAST UPDATE DATE

2024-11-23T22:18:54.940000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2012-2612	date:	2017-12-29T00:00:00
db:	BID	id:	53424	date:	2012-09-04T05:50:00
db:	JVNDB	id:	JVNDB-2012-002406	date:	2012-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201205-234	date:	2012-05-16T00:00:00
db:	NVD	id:	CVE-2012-2612	date:	2024-11-21T01:39:18.323

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2012-2612	date:	2012-05-15T00:00:00
db:	BID	id:	53424	date:	2012-05-08T00:00:00
db:	JVNDB	id:	JVNDB-2012-002406	date:	2012-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201205-234	date:	2012-05-16T00:00:00
db:	NVD	id:	CVE-2012-2612	date:	2012-05-15T04:21:43.597